extera-plugin-runtime / extera-runtime (PyPI): malicious packages exfiltrate Telegram files and run remote commands
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
On 2026-11-04 GitHub's advisory database, crediting OpenSSF's malicious-packages project and researcher kam193, published malware advisories for two PyPI packages: extera-runtime (version 1.1.0) and extera-plugin-runtime (versions 1.0.0 and 1.0.1), linked to a campaign dubbed 2026-11-extera-plugin-runtime. The packages masquerade as runtime components for the extera Telegram plugin ecosystem and contain code to exfiltrate sensitive Telegram files and execute a limited set of remote commands on victims' machines. The malicious code does not start automatically, requiring user invocation, which limits but does not eliminate risk. No patched versions exist; the packages are outright malware and should be removed. Any developer or Telegram user who installed these packages should treat Telegram session data and files as potentially compromised.
What to do
- Immediately uninstall extera-runtime and extera-plugin-runtime from all environments and remove them from dependency files and caches
- Rotate Telegram sessions and revoke active sessions; consider re-authenticating all Telegram accounts used on affected machines
- Audit machines that ran the packages for signs of remote command execution and review what Telegram files may have been accessed
- Block or flag these package names in internal PyPI mirrors, CI pipelines, and dependency-scanning tools
- Check lockfiles and build histories for any historical installation of the affected versions
Sources
All live incidents on Threat Watch
